Measured on the built artefact: main_ui.dylib DEFINES zero and IMPORTS zero of
TokenManager, StoreRegistry, LogosAPI, LogosAPIClient and logos_core_*, out of
3410 symbols read. It links Qt and nothing else from this workspace, which
nix/symbol-gate.nix enforces across the in-process image set.
Getting there needed the last non-Qt types off the boundary: the model
properties cross as QAbstractItemModel*, catalogInstallStageChanged carries an
int rather than InstallStage::Value, and the two prebuilt AppsFilterProxy
instances are declared in QML instead of owned by MainUIBackend. That last one
removes a real inversion -- PackageCoordinator called setRequiredPackages() on
a proxy the host held a pointer to; it now emits requiredPackagesResolved() and
QML binds to the republished property.
Window resolves the plugin, qobject_casts it to IShellView, checks
hostAbiVersion() against IShellHost_abi, and calls createShell(IShellHost*).
No error-label fallback widget: that degraded to something that looked like a
working app with an empty window.
Filter proxies read role constants off host-side models and InstallEnums is
used by nine host files, so app/interfaces/ gains the contract headers both
sides compile against -- the models inherit the role structs, leaving every
AppsModel::NameRole call site unchanged. The plugin's include path is
app/interfaces only, so including a host header does not compile.
Four things only running it finds:
* Logos::DesignSystem may be linked by exactly ONE image -- both linked it
and the app aborted with "Cannot add multiple registrations for
Logos.Icons"; QML module registration is process-global
* qmltyperegistrar emits no #include for a SOURCES header given as an
absolute path outside the project
* each qt_add_qml_module is its own target and inherits no include dirs
* AUTOMOC pairs header<->cpp by same-basename-same-DIRECTORY, which the
split breaks
tst_AppManagerView.qml grows five tests for the QML binding, checked with a
negative control: breaking one assertion fails qml-tests, so they run.
Each loaded plugin -- including pure-QML ones -- gets its own LogosAPI identity
rather than sharing the host's, so a plugin's calls are attributable and can be
refused independently. The host-services grant is wired through to
capability_module, and its trust root is guarded on an OUTCOME rather than a
log line.
Inter-module access policy stays OFF by default: enforce mode's derived
deny-by-default gates every ui_qml app's calls to its own backend module,
because UI plugins load out-of-process and are not tracked as dependents in the
core ModuleRegistry. Operators opt in per launch with --access-policy enforce
or LOGOS_ACCESS_POLICY.
Takes the Qt host runtime from logos-plugin-qt rather than logos-qt-sdk, which
keeps only the Qt<->lp seam headers, and moves logos-protocol onto the rev that
split host needs. On Windows logos_core must come LAST on the link line: GNU ld
resolves an archive left to right, so the view runtime's references have to be
undefined already when it reaches the import library.
Separates the two source trees -- app/ is the host, src/ is the UI shell -- and
brings the CI onto setup-nix-cache-action. Merges master.
* test: basecamp package lifecycle
* fix: accommodate changes from master
* fix: comment - Basecamp fetches its default repository catalog in the background
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: comment - hermetic — no catalog packages are downloaded or installed
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* test: basecamp package lifecycle
* fix: accommodate changes from master
* fix: comment - Basecamp fetches its default repository catalog in the background
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: comment - hermetic — no catalog packages are downloaded or installed
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: single install/upgrade confirmation dialog with dep-change list
basecamp now owns one confirmation dialog for catalog install, upgrade, and
downgrade, replacing the double-dialog where package_manager_ui and basecamp
both confirmed an upgrade/downgrade.
- Subscribe to the module's new beforeInstall gate; onBeforeInstall acks and
raises the shared ConfirmationDialog (new "installGate" mode). Confirm/cancel
forward to the module via confirmInstallGate / cancelInstallGate.
- onBeforeUpgrade now parses the depChanges the initiator resolved and threads
it into upgradeCascadeConfirmationRequested.
- ConfirmationDialog renders a transitive dependency-change list (install /
upgrade / downgrade rows) for the upgradeCascade + installGate modes, so the
single dialog shows exactly what else the operation changes.
Depends on logos-package-manager-module's requestInstall/depChanges gate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: re-pin package_manager module + PMU to the install-gate branches
Temporary branch pins so basecamp builds against the single-confirmation gate:
logos-package-manager-module -> #57 (requestInstall + depChanges)
logos-package-manager-ui -> #53 (routes through the gate)
Re-pin both to master once #57 and #53 land.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: forward install-gate confirmation through the MainUIBackend facade
The catalog-install gate reached basecamp (beforeInstall -> onBeforeInstall
acked the module and emitted installGateConfirmationRequested), but no dialog
appeared: QML's OverlayDialogs binds Connections{target: backend}, i.e. the
MainUIBackend facade, so PackageCoordinator's signal has to be re-emitted
there. It never was — the signal died at the facade and openWithInstallGate
was never called. The dialog buttons were dead too (backend.confirmInstallGate
/cancelInstallGate didn't exist on the facade).
Also fixes a silent arg-drop on the upgrade path: PackageCoordinator's
upgradeCascadeConfirmationRequested gained a 6th `depChanges` arg, but the
facade signal still had 5. A Qt signal->signal connect drops trailing args
when the receiver has fewer, so QML's 6-arg handler received depChanges as
undefined and the upgrade/downgrade dialog's dependency-change list was lost.
- forward installGateConfirmationRequested (signal decl + connect)
- add Q_INVOKABLE confirmInstallGate/cancelInstallGate slots delegating to
PackageCoordinator
- add the missing depChanges param to the facade upgradeCascadeConfirmationRequested
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: address review nits — disambiguate gate logs + fix stale dialog doc
- confirmInstallGate/cancelInstallGate warnings now say "confirmInstallGate
rejected" / "cancelInstallGate rejected" so they don't read as the local-LGX
confirmInstall()/cancelInstall() flow.
- ConfirmationDialog usage comment: openWithUpgrade now takes depChanges, and
document the new openWithInstallGate entry point.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: re-pin logos-package-manager-module input to merged master (#57)
#57 merged to logos-package-manager-module master (cad6bab). Re-point the
package_manager_module input off the temporary feat/unified-install-confirm
branch onto master. package_manager_ui stays on the PMU branch head until #53
merges. Builds green (.#main-ui-plugin).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: re-pin logos-package-manager-ui input to merged master (#53)
#53 merged to logos-package-manager-ui master (442243d), routing install/upgrade
confirmation through the host gate. Re-point the package_manager_ui input off the
temporary feat/unified-install-confirm branch onto master; its transitive
package_manager now resolves to the merged package_manager-module (cad6bab),
matching basecamp's direct pin. Builds green (.#main-ui-plugin).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Dario Gabriel Lipicar